- Tactics
- Persistence, Privilege Escalation
- Platforms
- Windows
- Reference
- attack.mitre.org/techniques/T1037.001
Description
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.(Citation: Hexacorn Logon Scripts)
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
How GTK Cyber trains on this
GTK Cyber's Threat Hunting with Data Science course teaches you to build machine-learning detections for techniques like this across the MITRE ATT&CK framework, including the Persistence, Privilege Escalation tactic this technique falls under. Practitioner-led, focused on real detections, not memorizing technique IDs.
Related techniques
- T1037 - Boot or Logon Initialization Scripts
- T1053 - Scheduled Task/Job
- T1055 - Process Injection
- T1068 - Exploitation for Privilege Escalation
- T1078 - Valid Accounts
- T1098 - Account Manipulation
- T1112 - Modify Registry
- T1133 - External Remote Services
- T1134 - Access Token Manipulation
- T1136 - Create Account
- T1137 - Office Application Startup
- T1176 - Software Extensions